At each level, in each zone, records are signed by one (or multiple) key, that is itself (the public part) in the zone as a DNSKEY record.
Also in parent zone a DS record (signed in the zone like any other records in that zone) "points" to the DNSKEY below by the virtue of being an hash of it and the domain name.
This is repeated at each level.
So if you start from root with a fully trusted key (an anchor, that must exist in each recursive nameserver), you find a signed DS record for some key inside the
.com zone where you find its DNSKEY record and all other records there are signed by this key, including the DS record of a key for
example.com in which zone you will find a DNSKEY record which key signs all other records, hence generating RRSIG records.
(This is of course simplified as often you have separate Zone Signing Keys and Key Signing Keys but this does not change the general idea above).
The keys are typically auto-generated by the nameserver or some external tools at some frequency (typically counted in months or few years). They must absolutely not be handled/generated by the parent zone, each zone is responsible of its keys, how much it has of them, how often it changes them, where are they stored (like on an HSM offline for the KSKs or simply on the filesystem). Each zone only gives a
DS record (one per key, specifically one per KSK, including those that do not correspond to published DNSKEY records yet, as a backup), to its parent zone, in order to build the chain of trust.
So it can be the owner of the domain or the DNSSEC signing (and hence key generating service) can be outsourced: some providers will give you a nameserver acting as a bump into the wire, it will serve a signed zone from your content by being a slave of your own nameservers serving an unsigned zone and managing the keys and signatures itself.
The signatures in
example.com are owned in a way (depends what you mean by owned) by the authoritative nameservers on this zone. They are either pre-calculated or calculated when the requests arrive (both models exist). Signatures themselves have a starting date and an end date.
Use an online tool like https://dnsviz.net/ to graphically display the chain of trust for any domain. Pass your mouse on various parts of the picture, you have overlays with a lot of useful information.
You can also use
dig +trace +dnssec locally. Or better now
delv +vtrace or